LAN security

LAN security

1. Endpoint Security

   • Network Attacks Today
     • Distributed Denial of Service,
     • Data Breach
     • Malware
   • Network Security Devices
     • VPN-Enabled Router: Provides a secure connection
     • NGFW: Provides stateful packet inspection
     • NAC: Includes authentication
   • Endpoint Protection
     • Endpoints are particularly susceptible to malware-related attacks that originate through email or web browsing.
   • Cisco Email Security Appliance
     • Block known threats.
     • Remediate against stealth malware that evaded initial detection.
     • Discard emails with bad links (as shown in the figure).
     • Block access to newly infected sites.
     • Encrypt content in outgoing email to prevent data loss.
   • Cisco Web Security Appliance
     • A mitigation technology for web-based threats.

2. Acces Control

   • Authentication with a Local Password
     • This method provides no accountability and the password is sent in plaintext.
   • Authentication
     • Local AAA Authentication
     • Server-Based AAA Authentication
   • AAA Components
     • Authentication Who are you?
     • Authorization How much can you spend?
     • Accounting What did you spend it on?
   • Accounting
     • AAA accounting collects and reports usage data.
   • Authorization
     • Is automatic and does not require users to perform additional steps after authentication.
   • 802.1X
     • Supplicant
     • Authenticator
     • Authentication

3. Layer 2 Security threats

   • Layer 2 Vulnerabilities
     • if Layer 2 is compromised, then all the layers above it are also affected
   • Switch Attack Categories
     • MAC Table Attacks
     • VLAN Attacks
     • DHCP Attacks
     • ARP Attacks
     • Address Spoofing Attacks
     • STP Attacks
   • Switch Attack Mitigation Techniques
     • Port Security
     • DHCP Snooping
     • Dynamic ARP Inspection (DAI)
     • IP Source Guard (IPSG)

4. LAN attacks

   • VLAN Hopping Attacks
     • enables traffic from one VLAN to be seen by another VLAN without the aid of a router.
   • VLAN Double-Tagging Attack
     • Disable trunking on all access ports.
     • Disable auto trunking on trunk links so that trunks must be manually enabled.
     • Be sure that the native VLAN is only used for trunk links.
   • DHCP Messages
     • Server
     • Client
   • DHCP Attacks
     • DHCP Starvation Attack
     • DHCP Spoofing Attack
   • ARP Attacks
     • Normal State with Converged MAC Tables
     • ARP Spoofing Attack
     • ARP Poisoning Attack with Man-in-the-Middle Attack
   • STP Attack
     • This STP attack is mitigated by implementing BPDU Guard on all access ports. BPDU Guard is discussed in more detail later in the course.